Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat — kairos

Return to Kairos
Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: 20250519

Initial Ransom
N/A
Negotiated Ransom
N/A
Ransom Paid
N/A
Victim
We are online and evaluating the situation, we will be in touch.
05/19/2025 04:21:32 am
Hi. We have more than 2tb (1602775 files) at our disposal. We will give you the full list of files we have and give you some time to study it.You can choose up to 10 files from this list and we will send them to you. In order to prevent the publication of data you need to pay 3000000$.
05/19/2025 06:58:58 am
Gang
temp.sh/[redacted]/output.rar pass: gfrpRD$er@
05/19/2025 07:13:21 am
Gang
Victim
We will review the list of files and get back to you
05/19/2025 08:21:27 pm
ok
05/19/2025 08:37:58 pm
Gang
Victim
The list you provided is extensive. Our team is working to understand the scope of the affected information. We will be touch.
05/20/2025 09:35:44 pm
Ok
05/20/2025 09:56:45 pm
Gang
Victim
We are still in the process of reviewing the list. We will get back to you.
05/22/2025 12:26:26 am
ok
05/22/2025 02:04:09 am
Gang
Victim
Thank you for your patience. We want to assure you that we are taking this matter very seriously, we are dedicating resources to analyze the situation.
05/23/2025 01:49:55 pm
We realize that the file volume is very large.We can give you some more time to analyze them.But please do not delay the process.
05/23/2025 02:23:30 pm
Gang
Victim
We want to assure you we are actively working on our analysis. Monday is a holiday and most of our decision makers will not be back until Tuesday. We will provide you with our file selection then.
05/23/2025 07:48:36 pm
ok
05/23/2025 08:27:51 pm
Gang
Victim
Incident 101-0069 (280651).pdf Media Release - Motorcycle Crash Claims the Life of [redacted] Resident 9-10-2020.pdf Sick leave batch 2.12.16.pdf 1095 Audit Dashboard Process Documentation.pdf [redacted] - Oath - 2023-03-20.pdf 1 [redacted] co psi template.doc IT Form for new hires.pdf Connection Fee Assessment Details_2016-01-29.doc [redacted].xlsx Claim form.pdf
05/27/2025 09:39:27 pm
1ty.me/[redacted] archive pass:Bt6&57r%b5&
05/27/2025 11:25:31 pm
Gang
We have prepared a list of files for you and they are available for download.We asked you to choose files from the list we sent you, but these files with these names are not there. Perhaps you have made a mistake in the name?(IT Form for new hires.pdf,Connection Fee Assessment Details_2016-01-29.doc).There are several files with the same name [redacted].xlsx and Claim form.pdf in different directories.We suggest we start discussing the deal.How long will it take you to pay and pre-publish the data?
05/27/2025 11:26:29 pm
Gang
Victim
We may be able to come to an agreement, but your current demand is way more than we have. We are a small county with limited resources. Can you give us a more reasonable number to consider?
05/28/2025 06:50:10 pm
We have conducted a full audit of your files and we understand perfectly well how valuable information we have in our hands and on this basis we demand such an amount.Do you understand what consequences will lead to the publication of this data? We are particularly interested in the folder “prosecutors office” leakage of data from which will help criminals to avoid responsibility and cause a strong public outcry and undermine confidence in you.We would not like to publish such data and come to an agreement.What is a reasonable amount in your opinion?
05/28/2025 07:12:55 pm
Gang
Victim
We understand your position and the sensitivity of the data you’ve referenced. We are currently reviewing with our legal and leadership teams. These are complex decisions that require coordination at multiple levels. We’ll need more time to complete that process. We appreciate your patience while we continue our internal discussions.
05/29/2025 09:54:25 pm
We understand your situation, how much time will you need?You should understand that if the process is delayed, we will be forced to announce your organization on our website with a timer.We need an exact date when you can make a payment decision.
05/29/2025 10:27:22 pm
Gang
Victim
We understand the urgency and are actively working through internal reviews and approvals. Due to the complexity of the situation and coordination required across departments, we will need at least until Wednesday. We appreciate your patience as we work toward a resolution.
05/30/2025 08:39:49 pm
Ok.
05/30/2025 08:54:47 pm
Gang
Victim
We have reviewed the situation with our leadership and financial teams. As a small county with very limited resources, we simply do not have the ability to meet the amount you have proposed. That said, we understand the seriousness of the matter and want to work toward a resolution. The most we have been able to identify at this time is $100,000. We respectfully ask that you consider this offer.
06/04/2025 06:16:54 pm
You are wasting our time with such offers.We cant accept it.Your files will be a great advertisement on our site and we understand what terrible consequences will await you.You cant hide the data leak.You have two more days to make us a favorable offer.
06/04/2025 07:11:29 pm
Gang
Victim
Please understand we’re not trying to waste anyone’s time. As a small county with limited resources, we’re doing everything possible to address this situation responsibly. We remain committed to finding a resolution and are holding ongoing internal discussions. We will update you tomorrow.
06/05/2025 09:56:59 pm
Victim
After further internal discussions, we have been able to identify $255,000 as a figure we can put forward at this time. Going public would only make resolution more difficult on both sides. We’re sharing this offer in good faith and hope you’ll be willing to continue the conversation.
06/06/2025 06:04:17 pm
We are willing to give you a discount and will settle for 2 million.We realize that bidding is part of the deal, but lets not drag this process out.Youve seen the documents we have,we also know how important they are to you.Making your documents public will cost you more than $250,000 in damages.You also know how badly your reputation would be damaged.Your negligence could hurt innocent people whose documents you lost.We are very pleased to talk to you,but lets speed up our dialog and move on to more realistic amounts to negotiate.
06/06/2025 06:26:37 pm
Gang
Victim
We appreciate you working with us. We’ll need to review your latest response further with our leadership team. Those discussions will continue over the weekend, and we plan to follow up with you on Monday.
06/06/2025 08:48:25 pm
We want to see a really good offer on Monday.Thank you for your understanding.
06/06/2025 09:00:44 pm
Gang
Victim
We recognize and respect the effort you have made to move this forward. As a small county and limited resources, we are doing our best to navigate this within what is financially feasible for us. That said, we are committed to finding a resolution and have taken steps internally to increase our offer to $430,000. This reflects a sincere attempt to make progress despite our constraints. We ask that you consider this proposal as part of a continued effort to resolve the matter in a constructive and timely manner.
06/09/2025 06:57:46 pm
We asked you not to delay with negotiations and waited for a normal offer.Your situation could be solved today.Our last word is $1M.We give you time till Friday. If we do not see this amount on Friday on our wallet,your files will be immediately published on our site.
06/09/2025 07:38:52 pm
Gang
bc1q0zkms9vuhp767q6yp3t4tj8fkellxz5h3dxgvl
06/09/2025 07:39:42 pm
Gang
Victim
Please confirm for $1,000,000 you will provide us with: proof of deletion, a complete list of all files taken, and tell us how you got in.
06/12/2025 06:43:40 pm
temp.sh/[redacted]/output.rar archive pass:Tb6NtGtb6b%%.We duplicate the list of files for you.
06/12/2025 07:06:52 pm
Gang
We guarantee complete removal of your documents,we are committed to keeping our communication and transaction confidential.
06/12/2025 07:08:02 pm
Gang
Victim
We are preparing to transfer the funds. We hope to have this resolved shortly.
06/13/2025 07:37:25 pm
Victim
Payment has been sent. Please confirm.
06/13/2025 08:16:09 pm
Thank you.The payment is accepted.We will prepare information for you soon and send it to the chat.Your data is in the process of deletion as we promised.
06/13/2025 10:20:05 pm
Gang
Victim
Thank you for confirming, do you have an ETA for the deliverables so we can keep our leadership informed?
06/16/2025 01:53:10 pm
The incident was very simple. We accessed your network using a bruteforce attack. We are attaching cybersecurity recommendations as well as proof of deletion of all downloaded files in special files. We also guarantee that we will not share the downloaded data with third parties, and we also guarantee that we will not attack you again. If everything is ok, we can delete our chat.
06/16/2025 05:04:36 pm
Gang
temp.sh/[redacted]/[redacted].rar
06/16/2025 05:05:13 pm
Gang